If your public keys are properly named in the authorized_hosts file, then you would just use sed to remove the relevant keys. If you don't want to do that, any

If your public keys are properly named in the authorized_hosts file, then you would just use sed to remove the relevant keys. If you don't want to do that, any centralised user management system would allow removal of the user from the allowed ssh group, and adding a VPN layer is good too.